CVE-2026-20526

MediaTek’s modem has an out-of-bounds write caused by a missing bounds check (CWE-787, CVE-2026-20526). An attacker who runs a rogue base station can trigger the flaw when user equipment connects to that station; user interaction is required and no further privileges on the device are needed. Successful exploitation can remotely escalate privileges on the affected device. The issue is tracked as MSV-8906 and fixed by patch MOLY01898195, but the supplied data does not list affected chipsets or firmware versions. No public proof-of-concept is known and the CVE is not in CISA KEV, so exploitation in the wild is not known.

What to do: Install handset or device firmware that includes MediaTek patch MOLY01898195 (issue MSV-8906) as soon as the OEM publishes it. Until then, avoid connecting to unknown or suspicious cellular networks, because exploitation requires the device to attach to an attacker-controlled base station. Check MediaTek and device-vendor advisories for the chipsets actually covered by this fix.